CI: migrate GitHub Actions off deprecated Node.js 20 runtime

[hellno]

GitHub is forcing Actions to Node.js 24 by 2026-06-02 and removing Node 20 from runners by 2026-09-16. Workflows surface this as a deprecation annotation today; after the cutover, actions still pinned to the Node 20 runtime may break.

Ref: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Actions in use across .github/workflows/

Bump each to a Node 24-compatible release (or confirm the current major already supports it):

• actions/checkout@v4 → v5
• actions/setup-node@v4 → v5
• actions/upload-artifact@v3 → v4 (v3 is already separately deprecated)
• actions/cache@v4 → confirm Node 24 support
• denoland/setup-deno@v1 → confirm latest
• pnpm/action-setup@v4 → confirm latest
• dorny/paths-filter@v3 → confirm latest
• supabase/setup-cli@v1 → confirm latest
• getsentry/action-release@v1 → confirm latest
• tauri-apps/tauri-action@v0 → confirm latest
• actions-rs/toolchain@v1 → unmaintained; replace with dtolnay/rust-toolchain

Affected workflows

build.yaml, signing-service-tests.yml, edge-functions-typecheck.yml, deploy-supabase-functions.yml, supabase-migration-lint.yml, claude-code-review.yml, claude.yml

Done when

All workflows run clean with no Node 20 deprecation annotations.

[hellno]

Cross-link: the TanStack-Start-on-Cloudflare migration (#754, Track B) makes node ≥22 a hard requirement for the CF build path — web:build / web:serve (wrangler + workerd) won't run on node 20. I had to drive unit #5's build/canary on nvm's node 22; the repo .nvmrc is still v20.12.2, so local CF builds need a manual switch today.

When this CI migration lands, the Cloudflare build job and .nvmrc should target ≥22 alongside the Actions runner bump. Related: the #13 cutover and the planned CI gzip-budget assertion (docs/migration/phase-2-shell.md follow-ups) both assume the ≥22 toolchain.